[
https://issues.apache.org/jira/browse/WICKET-6253?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Martin Grigorov resolved WICKET-6253.
-------------------------------------
Resolution: Won't Fix
Closing as "Won't fix" because the change in UrlEncoder is rather big and there
are workarounds.
> Redirect url parameters decoded
> -------------------------------
>
> Key: WICKET-6253
> URL: https://issues.apache.org/jira/browse/WICKET-6253
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 6.16.0
> Reporter: Viktor Durica
> Labels: encode, parameters, redirect, saml, servlet
> Attachments: wicket6253.zip
>
>
> When redirecting to an external url using RedirectToUrlException,
> org.apache.wicket.protocol.http.servlet.ServletWebResponse.encodeRedirectURL()
> changes the location. Decodes the parameters but encode does not give the
> same result.
> SAMLv2 (opensaml) generates authentication request and signs it, IDP fails to
> validate signature as parameters have changed. Example:
> http://example.host/sso/login/redirect?SAMLRequest=XYZ&RelayState=%2Fcomeback%2Fhere&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=XYZ
> ServletWebResponse .encodeRedirectURL() changes it to:
> http://example.host/sso/login/redirect?SAMLRequest=XYZ&RelayState=/comeback/here&SigAlg=http://www.w3.org/2000/09/xmldsig#rsa-sha1&Signature=XYZ
> diff where change was created:
> http://grepcode.com/file_/repo1.maven.org/maven2/org.apache.wicket/wicket-core/6.16.0/org/apache/wicket/protocol/http/servlet/ServletWebResponse.java/?v=diff&id2=6.15.0
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
